input {
  {{ item.protocol }} {
    port => {{ item.port }}
    codec => plain
    tags => ["syslog-rfc"]
  }
}

filter {
  fingerprint {
    target => "[@metadata][uuid]"
    method => "UUID"
  }
}

output {
  if "syslog-rfc" in[tags]{
    elasticsearch {
      hosts => ['{{ opendistro_servers | list | join(":" + opendistro_port.rest + "', '") }}:{{ opendistro_port.rest }}']
      ssl_certificate_verification => false
      ssl => true
      user => "logstash"
      ilm_enabled => false
      password => "{{ lookup("password", "" + group_names[0] + ":logstash length=12 chars=ascii_letters,digits") }}"
      index => "logstash-syslog-rfc-%{+YYYY.MM.dd}"
      template => "/etc/logstash/template/logstash-syslog-rfc-template.json"
      template_name => "logstash-syslog-rfc"
      template_overwrite => true
      document_id => "%{[@metadata][uuid]}"
    }
  }
}
